ETH was moved out of a Bybit Ethereum cold wallet

Bybit sued the North Korean side in the United States, and recovery was still limited

Enforcement · Bybit

Decrypt reported that Bybit sued North Korea, the Reconnaissance General Bureau, and Lazarus Group in U.S. federal court. The report cited the project. About $48.4 million had been recovered. About $30.5 million was frozen at more than 28 exchanges and custodians. Together that was about 5% of the stolen amount. A judge issued a preliminary injunction freezing the related assets.

It was an attack on trust in our industry.

• Decrypt · Article · Secondary

The FBI found that North Korea's TraderTraitor stole about $1.5 billion

Enforcement · FBI

In the notice numbered I-022625-PSA, the FBI attributed the theft directly. It said some assets had been swapped into bitcoin and spread across many addresses on multiple chains. The notice asked nodes, exchanges, bridges, and DeFi services to block the related addresses, and it listed a batch of Ethereum addresses. The FBI's about $1.5 billion and Bybit's about $1.46 billion are both kept.

The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.

• FBI IC3 · Statement · Primary

The chief executive said this cold wallet had fallen, but the platform could cover it

Statement · Ben Zhou · @benbybit

Bybit's timeline places Ben Zhou's post at 15:44 UTC. He said the attacker controlled this ETH cold wallet. He pledged that the platform was solvent and that client assets were covered 1:1. The original wording below comes from The New York Times' citation of that post.

Even if this hack loss is not recovered, all of clients assets are 1 to 1 backed. We can cover the loss.

• Bybit Learn · Statement · Primary
• The New York Times · Article · Secondary

The Safe multisig interface was swapped, and the cold-wallet logic was changed

Technical · Bybit

Bybit wrote that the attacker used phishing against the interface of the Safe multisig cold wallet. The transaction that was signed changed the contract logic of this ETH cold wallet. The funds were moved to 39 addresses. The project's breakdown was 401,347 ETH, 90,375 stETH, 15,000 cmETH, and 8,000 mETH. The total was written as $1.46 billion.

• Bybit Learn · Statement · Primary

A routine transfer moved 30,000 ETH out of the cold wallet

Technical · Bybit

Bybit's later timeline says that at 13:30 UTC that day, under the routine process, they transferred from an Ethereum multisig cold wallet to a hot wallet. The first transfer was 30,000 ETH.

• Bybit Learn · Statement · Primary